ci: enforce the local verify:cheap gate set in CI + gate-manifest self-test (maturity L3)#1002
Conversation
…f-test (maturity L3) Three gates ran in the local `verify:cheap` chain but in NO workflow — `sitemap:check`, `check:therapy-data-index`, `check:design-system-contract` — so a site-map, therapy-index, or design-system-contract regression merged green (the CI aggregate never ran them). This is the same class of miss the static-pr job already documents for the type/icon/brand guards. - Add the three drift detectors to the static-pr job (all pass on main). - Add scripts/check-gate-manifest.mjs: a self-test asserting every `verify:cheap:internal` gate is enforced in CI (in static-pr, or via an explicit mapping for `test` -> `test:coverage` in the coverage job), so a gate added to the local chain can no longer be silently missed in CI. Wired into both `verify:cheap:internal` and the static-pr job. Verified: `check:gate-manifest` passes; before the fix it failed on exactly the three drifted gates (proving it catches the regression); ci-scope / ci-triage / pr-policy / github-actions self-tests, eslint, and prettier all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR adds a gate-manifest CLI that compares local verification scripts with CI commands, exposes it through npm scripts, and runs it alongside sitemap, therapy data index, and design-system contract checks in the ChangesCI gate enforcement
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/check-gate-manifest.mjs`:
- Around line 35-36: Update the line parsing in the manifest-checking logic
around the scripts extraction and static-pr gate extraction to ignore YAML
comments and match only actual, line-anchored run fields. Require the expected
YAML indentation and field structure before capturing script or gate names,
while preserving the existing collection behavior for valid CI steps.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 08aac9b2-897f-47ce-b015-e686fb142d17
📒 Files selected for processing (3)
.github/workflows/ci.ymlpackage.jsonscripts/check-gate-manifest.mjs
The npm-run extraction regexes were unanchored, so a YAML comment that merely mentioned `run: npm run X` counted as an executed CI gate — which would let the drift check pass after the real step had been deleted, defeating the guard. Parse line-anchored `run:` fields only, via a shared npmRunScript() helper (a trailing `# comment` on a real step is still allowed). Verified: the self-test still reports all 20 gates enforced; the negative drift test still fires when a step is removed; and a comment line mentioning `run: npm run test:coverage` now correctly yields no gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
2 participants
Summary
Maturity backlog L3 (single gate manifest). While scoping it I found a concrete gap: three gates ran in the local
verify:cheapchain but in no workflow at all, so a regression they catch would merge green because the CIpr-requiredaggregate never ran them:sitemap:check(site-map drift)check:therapy-data-index(therapy-index drift)check:design-system-contract(design-system contract)This is the same class of miss the
static-prjob already documents in a comment — it records the type/icon/brand guards being promoted into CI after they drifted green as local-only checks. These three are one iteration later.static-prjob (all three pass on currentmain— verified before adding, so CI stays green).scripts/check-gate-manifest.mjs— a self-test asserting everyverify:cheap:internalgate is enforced in CI (instatic-pr, or via an explicit mapping fortest→test:coveragein the coverage job). Wired into bothverify:cheap:internaland thestatic-prjob, so a gate added to the local chain can no longer be silently missed in CI. The mapping/exemption tables are explicit and commented, so any future asymmetry is a conscious, reviewed edit.Direction is intentionally one-way: CI may run more than the local chain (e.g.
format:check, build/e2e in other jobs); it must never run less of the local static set.Diff: 3 files —
+scripts/check-gate-manifest.mjs(87),.github/workflows/ci.yml(+17, four steps),package.json(+1 script, wired intoverify:cheap:internal).Verification
npm run check:gate-manifest— pass ("all 20 verify:cheap gates are enforced in CI"). Negative test: before adding the three CI steps it failed with exactly those three gates named — proving it catches the regression.npm run sitemap:check,npm run check:therapy-data-index,npm run check:design-system-contract— all pass onmain(safe to enforce in CI).npm run check:ci-scope,npm run check:ci-triage,npm run check:pr-policy,npm run check:github-actions— pass (CI-structure self-tests unaffected; no new actions added).npm run check:runtime— pass; eslint on the new script — clean;npm run format:check— pass.verify:cheap(itsteststep is the slow vitest run) — the change adds gates and a manifest check, it doesn't alter any existing gate's behaviour.Risk and rollout
main; the self-test is additive. The main watch-point is that the three checks must stay green in CI (they are onmain).Clinical Governance Preflight
N/A — CI/tooling change only; no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed.
Notes
Completes L3 from
docs/maturity-backlog-workorders.md. The self-test'sCI_EQUIVALENT/LOCAL_ONLYtables are the documented seam for any future intentional asymmetry between the local and CI gate sets.Generated by Claude Code
Summary by CodeRabbit